Data Processing Agreement

This DPA governs the processing of personal data by Reviewed on behalf of the Controller when the Controller uses Reviewed to manage customer communication and review follow-up messaging.

This Agreement applies to all personal data processed by Reviewed in connection with the Service.

4.1 Controller Responsibilities

• Determines the purposes and means of processing personal data
• Ensures lawful basis for processing under Applicable Data Protection Law
• Obtains valid consent from data subjects where required
• Provides privacy notices to data subjects
• Ensures accuracy and quality of personal data

4.2 Processor Responsibilities

• Processes personal data only on documented instructions from the Controller
• Implements appropriate technical and organisational security measures
• Ensures confidentiality of personnel processing personal data
• Assists the Controller in fulfilling data subject rights requests
• Notifies the Controller of any data breaches without undue delay

Reviewed processes personal data only as instructed by the Controller through the Controller's use of the Service, configuration settings and templates, and direct instructions via support channels.

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security audits and vulnerability assessments
• Employee confidentiality agreements
• Incident response procedures
• Regular backups

Reviewed uses the following trusted sub-processors to operate the Service and provide connected features:

Several of these providers are based outside the UK and may process personal data in the United States.

Reviewed will assist the Controller in responding to data subject rights requests including:

In the event of a personal data breach, Reviewed will notify the Controller without undue delay and no later than 72 hours after becoming aware, providing:

• Nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences
• Measures taken or proposed to address the breach

Upon termination of the Service or upon request, Reviewed will delete or return personal data to the Controller and delete existing copies, unless retention is required by law. Deletion is handled in line with the retention periods set out in the Privacy Policy.

Reviewed will make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits upon reasonable notice.

Some sub-processors process or store personal data outside the United Kingdom, including in the United States. Where international transfers occur, Reviewed protects those transfers using appropriate safeguards, including the UK International Data Transfer Agreement (IDTA) and/or Standard Contractual Clauses, where required by Applicable Data Protection Law.

This DPA remains in effect for as long as Reviewed processes personal data on behalf of the Controller. Obligations survive termination where required by law.